Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

The Hidden Dangers of Public Serverless Repositories: An Empirical Security Assessment

Eduard Marin, Jinwoo Kim, Alessio Pavoni, Mauro Conti, Roberto Di Pietro

TL;DR

The paper addresses the security risks arising from public serverless repositories and IaC templates, the rapid reuse of serverless components, and the lack of transparency around security practices. It conducts a large-scale empirical analysis of 2,758 serverless components across five repositories and 125,936 IaC templates across Terraform, CloudFormation, and AWS SAM, using multiple scanners (Trivy, Grype), VirusTotal, and DL-distance for typo-squatting detection. It uncovers systemic vulnerabilities including outdated libraries, novel malicious-packaging via compression, misconfigurations in IaC templates, and exposure of sensitive parameters, along with evidence of typo-squatting risk and new risky Docker run parameters. The study provides actionable recommendations for repository maintainers and users to implement automated vulnerability scanning, configuration controls, and naming-policy safeguards, highlighting the need for continuous monitoring in the evolving serverless ecosystem. Overall, it demonstrates that public serverless repositories pose tangible security threats unless robust, transparent security practices and automated defenses are adopted.

Abstract

Serverless computing has rapidly emerged as a prominent cloud paradigm, enabling developers to focus solely on application logic without the burden of managing servers or underlying infrastructure. Public serverless repositories have become key to accelerating the development of serverless applications. However, their growing popularity makes them attractive targets for adversaries. Despite this, the security posture of these repositories remains largely unexplored, exposing developers and organizations to potential risks. In this paper, we present the first comprehensive analysis of the security landscape of serverless components hosted in public repositories. We analyse 2,758 serverless components from five widely used public repositories popular among developers and enterprises, and 125,936 Infrastructure as Code (IaC) templates across three widely used IaC frameworks. Our analysis reveals systemic vulnerabilities including outdated software packages, misuse of sensitive parameters, exploitable deployment configurations, susceptibility to typo-squatting attacks and opportunities to embed malicious behaviour within compressed serverless components. Finally, we provide practical recommendations to mitigate these threats.

The Hidden Dangers of Public Serverless Repositories: An Empirical Security Assessment

TL;DR

The paper addresses the security risks arising from public serverless repositories and IaC templates, the rapid reuse of serverless components, and the lack of transparency around security practices. It conducts a large-scale empirical analysis of 2,758 serverless components across five repositories and 125,936 IaC templates across Terraform, CloudFormation, and AWS SAM, using multiple scanners (Trivy, Grype), VirusTotal, and DL-distance for typo-squatting detection. It uncovers systemic vulnerabilities including outdated libraries, novel malicious-packaging via compression, misconfigurations in IaC templates, and exposure of sensitive parameters, along with evidence of typo-squatting risk and new risky Docker run parameters. The study provides actionable recommendations for repository maintainers and users to implement automated vulnerability scanning, configuration controls, and naming-policy safeguards, highlighting the need for continuous monitoring in the evolving serverless ecosystem. Overall, it demonstrates that public serverless repositories pose tangible security threats unless robust, transparent security practices and automated defenses are adopted.

Abstract

Serverless computing has rapidly emerged as a prominent cloud paradigm, enabling developers to focus solely on application logic without the burden of managing servers or underlying infrastructure. Public serverless repositories have become key to accelerating the development of serverless applications. However, their growing popularity makes them attractive targets for adversaries. Despite this, the security posture of these repositories remains largely unexplored, exposing developers and organizations to potential risks. In this paper, we present the first comprehensive analysis of the security landscape of serverless components hosted in public repositories. We analyse 2,758 serverless components from five widely used public repositories popular among developers and enterprises, and 125,936 Infrastructure as Code (IaC) templates across three widely used IaC frameworks. Our analysis reveals systemic vulnerabilities including outdated software packages, misuse of sensitive parameters, exploitable deployment configurations, susceptibility to typo-squatting attacks and opportunities to embed malicious behaviour within compressed serverless components. Finally, we provide practical recommendations to mitigate these threats.
Paper Structure (18 sections, 7 figures, 4 tables)

This paper contains 18 sections, 7 figures, 4 tables.

Table of Contents

  1. Introduction
  2. Background and Motivation
  3. Serverless Deployment Models
  4. Attack Vectors in Public Serverless Repositories
  5. Threat Model
  6. Security Analysis Framework for Public Serverless Repositories
  7. Application-level Security Risks
  8. Vulnerability Analysis in Third-party Libraries
  9. Hiding Malicious Behaviour in Compressed Serverless Components
  10. Configuration and Deployment Security Risks
  11. Sensitive Parameter Misuse in Docker Run Commands
  12. Security Analysis of IaC Templates
  13. Typo-squatting Attacks
  14. Key Findings and Discussion
  15. Related work
  16. ...and 3 more sections

Figures (7)

  • Figure 1: CDF of vulnerability counts per serverless component.
  • Figure 2: Trivy vs. Grype vulnerability similarity.
  • Figure 3: Vulnerability severity using data from Trivy (left) and Grype (right).
  • Figure 4: Relationship between serverless components compressed with various compression algorithms and the number of engines that successfully detect them.
  • Figure 5: Misconfigurations severity reported by Trivy for: (a) AWS Serverless Repository; and, (b) GitHub.
  • ...and 2 more figures